Insights · Hardening guide

System hardening with CIS Benchmarks: what to know before you start

CIS Benchmarks are consensus-based configuration guides that tell you how to set up operating systems, cloud accounts, containers, databases and network devices more securely. The safe way to use them is to pick a profile, test it on a pilot group, document exceptions and then monitor for drift, instead of switching every setting on at once.

Updated: 6 November 2026

What CIS Benchmarks are and what they cover

The Center for Internet Security (CIS) publishes the CIS Benchmarks as prescriptive configuration recommendations. Volunteer experts, vendors and community members draft each one, discuss and test it on the CIS WorkBench platform, and publish it once the group reaches consensus. Each recommendation states what to set, why it matters and how to check it.

CIS describes its catalog as covering more than 25 vendor product families, grouped into cloud providers, desktop software, DevSecOps tools, mobile devices, network devices, operating systems, server software and storage devices. Examples named by CIS include AWS, Azure, Kubernetes, Docker, Microsoft Windows, Ubuntu, Red Hat Enterprise Linux, Oracle Database and several network vendors.

Benchmarks follow the release cycle of the technology and the community, so versions change. According to CIS, the Windows benchmarks cover the latest Windows build within 90 days of its release. Always check which benchmark version matches the exact product version you run.

Level 1, Level 2 and the STIG profile

Most benchmarks split their recommendations into profiles. According to the CIS FAQ, Level 1 is a base set that can be implemented fairly promptly and is designed to cut attack surface without a large performance or usability cost. Level 2 is meant as defense in depth for environments where security is paramount, and CIS warns that it can cause problems if applied without care.

Some benchmarks also contain a STIG profile, which replaces the former Level 3. It collects the recommendations that come from the DISA STIG and includes overlapping Level 1 and Level 2 items where they apply.

A practical reading: start with Level 1 almost everywhere, and apply Level 2 selectively to systems that hold sensitive data or face higher threat levels. CIS itself advises testing any profile in a test environment first.

How benchmarks relate to the CIS Controls

The CIS Critical Security Controls are a different document. They are a prioritized set of security practices for a whole program: asset inventory, access control, logging, incident response and more. As of the CIS page checked in November 2026, the current version is v8.1, released in June 2024, with 18 Controls. Version 8.1 added a Governance security function and aligned its mappings with NIST CSF 2.0. The Controls are grouped into Implementation Groups so smaller organizations can begin with essential hygiene.

The Benchmarks are the detailed settings that help you carry out one of those Controls, secure configuration of enterprise assets and software. Think of the Controls as the what and the Benchmarks as the how for configuration.

How to assess compliance

You need a way to compare real systems against the benchmark. Options fall into three groups, and many organizations combine them.

Whatever you choose, check which benchmark versions and profiles the tool supports, and treat a green score as partial evidence. Microsoft states for its Azure Policy initiative that a compliant result only means the mapped policies pass, and that some benchmark items have no policy at all and need other evidence.

• Benchmark-vendor tools: CIS offers CIS-CAT Pro Assessor, which checks systems against CIS Benchmarks, and a Lite edition. CIS-CAT Pro is part of the CIS SecureSuite membership.
• General scanners and SCAP tools: commercial vulnerability and compliance scanners, and open-source options such as OpenSCAP, can evaluate many configuration profiles and report on them.
• Cloud-native services: AWS Security Hub supports several versions of the CIS AWS Foundations Benchmark, and Azure Policy has a built-in initiative for the CIS Microsoft Azure Foundations Benchmark. Both leave some items for manual review.

Rolling out hardening without breaking production

Hardening fails most often because a setting breaks an application nobody documented. A staged approach lowers that risk.

Keep the final baseline small and versioned. When a new benchmark version appears, review the differences and update the baseline through the same process.

• Inventory first: know which systems, owners and applications exist, and group them by role.
• Define a baseline per role: for example Level 1 for general servers, selected Level 2 items for domain controllers or database hosts.
• Test on a pilot group and a staging copy, with the application owners checking real workflows.
• Record exceptions: when you deviate from a recommendation, write down the reason, the compensating control, an owner and a review date.
• Push changes through change management, with a rollback plan and a staggered schedule.
• Enforce with configuration management or policy tooling such as group policy, Ansible, Intune or infrastructure code, so the baseline is repeatable.
• Monitor drift: rescan on a schedule and alert when systems leave the baseline, because patches, admins and new deployments will change settings over time.

Alternatives and complements

DISA STIGs are configuration guides published through the DoD Cyber Exchange under the Defense Information Systems Agency. They are strict, aimed at US defense environments, and available as SCAP content. Teams outside that setting sometimes use them as a stricter reference, and CIS offers a STIG profile in some benchmarks.

Microsoft publishes its own security baselines for Windows, Microsoft 365 Apps and Edge in the Security Compliance Toolkit, with tools such as Policy Analyzer and LGPO to compare and apply group policy objects. They overlap with CIS for Windows but are not identical, so pick one as your primary reference and document differences.

In Germany, the BSI IT-Grundschutz covers hardening as part of a broader information security management method. The current Kompendium remains applicable during a multi-year transition, according to the BSI. A modernized version called Grundschutz++ was published as a methodology in April 2026 and is reported to be in a pilot phase, with the old approach staying valid until the end of 2028, according to a law firm summary. Check the BSI site for the latest status before you commit to a certification path.

When to involve a provider

You can run a first Level 1 rollout on a small, well-understood environment with your own team. A provider becomes worthwhile when the scope is large, systems are old or poorly documented, you must prove compliance to an auditor or customer, or you lack staff to test, enforce and monitor.

Useful help includes baseline design, automation, pilot testing, exception handling, and managed scanning with regular reports. Ask any provider which benchmark versions they work with, how they test before enforcement and how they report drift.